CVE-2026-49831: DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.

CVE-2026-49831 · Severity: medium · CVSS 5.5 · Published 2026-09-02

DSpace, an open-source platform for digital repositories, contains a vulnerability in its Curation Task feature. An attacker with administrative credentials can manipulate file output paths to overwrite critical system files or configuration settings. This could lead to a complete service outage or unauthorized changes to the platform's behavior.

Technologies: org.dspace:dspace-api (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-49831 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49831 being exploited in the wild.
How severe is CVE-2026-49831?
Medium severity, with a CVSS score of 5.5, published 2 September 2026.
Which products and versions are affected?
org.dspace:dspace-api (Maven) ECOSYSTEM:introduced=0,fixed=7.6.7.
Is there a fix for CVE-2026-49831?
Yes. org.dspace:dspace-api (Maven): upgrade to 7.6.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49831 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49831?
Check whether you run org.dspace:dspace-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.dspace:dspace-api (Maven): upgrade to 7.6.7 or later
    # set org.dspace:dspace-api to 7.6.7 in your pom.xml or build.gradle

Technical details

A path traversal vulnerability exists in the DSpace Curation Task Reporter due to insufficient validation of the output path parameter (-r). While originally a command-line tool, the feature is now accessible via the web UI to Collection, Community, and Site Administrators. An attacker with these administrative privileges can specify an arbitrary output path writable by the web server user (e.g., 'tomcat'). This can be used to overwrite configuration files in /dspace/config or binaries in /dspace/bin, potentially leading to Denial of Service (DoS) or further privilege escalation if combined with other vulnerabilities. The fix restricts output to configured directories and disables the reporter parameter for web-managed processes.

Affected products

  • DSpace DSpace <= 7.6.6, 8.0 <= 8.3, 9.0 <= 9.2, 10-rc1

Identifiers

  • CVE-2026-49831
  • GHSA-v66x-68f2-pxf5

Timeline

  • 2026-06-01: disclosed
  • 2026-07-08: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.